Breach Disclosure: Quidd

Quidd, an online marketplace for trading stickers, cards and other collectibles, suffered a data breach in 2019. The breach contained approximately 4 million rows of user data, which are now being circulated for free in underground hacking and cybercrime forums. The data includes email addresses, usernames and bcrypt password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Those amongst the underground hacker forum community attribute the breach to a hacker known as ProTag. Multiple posts have been made on these forums that shout out ProTag. The data was traded privately for a number of months, but has now been made free to download amongst these users. This could be due to the password hashes being hashed using bcrypt, which makes it much harder to brute force passwords at scale.

ZDnet1 Image from ZDNet where a user posted the data for free